Access Control

Access Control determines who can sign in to your workspace and what they can do after signing in. Start with the task a person needs to perform, then check their account, roles and permissions.

Access needed

Access depends on your assigned permissions and workflow scope.

View or manage workspace users: identity.users.manage
Role choices additionally require identity.roles.read. An employee record is separate from a sign-in account.
Role and permission labels
Typical responsibility: User administrator. Role names alone do not grant access.
Manage workspace user accounts and assignments
Read roles and browse permissions: identity.roles.read
Read access does not grant role changes or user administration.
Role and permission labels
Typical responsibility: Access reviewer. Role names alone do not grant access.
Read roles and the permission catalogue
Create or change roles and their permissions: identity.roles.manage
The permission picker additionally needs identity.roles.read. Built-in protections and assigned-user restrictions still apply.
Role and permission labels
Typical responsibility: Role administrator. Role names alone do not grant access.
Manage role definitions and permissions
Choose and assign roles to a user: All:identity.users.manageidentity.roles.read
Assignment changes and catalogue reads are separate requirements.
Role and permission labels
Typical responsibility: User administrator. Role names alone do not grant access.
Manage workspace user accounts and assignments
Read roles and the permission catalogue
Read or change workspace sign-in settings: identity.settings.manage
Own account security is a separate signed-in self-service workflow.
Role and permission labels
Typical responsibility: Sign-in administrator. Role names alone do not grant access.
Manage workspace sign-in settings
Read workspace Access Control history: audit.read
Tenant history access does not grant platform audit access or account changes.
Role and permission labels
Typical responsibility: Authorized investigator. Role names alone do not grant access.
Read the service Activity log

Demo screenshots may show broader access than your account.

Understand the three parts

Part	What it means	Example
User	A sign-in account belonging to this workspace.	A colleague's account, active state and employee link.
Role	A collection of permissions assigned to one or more users.	Employee, Manager, HR manager or a custom role.
Permission	Access to a particular operation.	Reading leave requests is separate from approving them.

A person can hold several roles. Their permissions combine across those roles. A role's name alone does not establish what they can do: permitted built-in roles can be customized, and custom roles can have different access in each workspace.

Start with the user account

Open Access Control → Users. Search for the person and review their account status, assigned roles and employee link. Use the account record to investigate sign-in access; use the employee record to maintain employment information.

Workspace Users list showing account access information — Illustrative demo access; your workspace configuration may differ.

Inspect roles before changing access

Open Access Control → Roles. Review the role name, assigned-user count and whether it is built-in or custom. Open a role to inspect its Details and Permissions tabs.

Built-in roles and assigned-user counts — Illustrative demo access; your workspace configuration may differ.

In Permissions, expand a module and read the individual operations. Selected permissions belong to that role; they are not a complete summary of every user's access, because a user may hold other roles too.

Employee role permissions with the Leave group expanded — Illustrative demo access; your workspace configuration may differ.

Use the permission catalogue

Open Access Control → Permissions to browse modules and their available permissions. Search for the relevant module or operation and use the descriptions to distinguish reading, managing and approving records.

Workspace permission modules and role counts — Illustrative demo access; your workspace configuration may differ.

The catalogue explains available access. It does not assign that access to a person. Role assignments belong to the user's account; permission selections belong to a role.

Plan a person's access

Identify their tasks
List what the person should view, create, change or approve. Check the Access needed section of each relevant guide.
Check the existing account
Confirm you are in the correct workspace and inspect the account status and employee link. Avoid creating a second account for the same person.
Compare the available roles
Inspect actual permissions rather than relying on a familiar role name. Reading records and changing them are separate responsibilities.
Review the result with the account holder
After an authorized access change, have the person refresh their session and check the intended workflow. Confirm both the actions they need and any actions that should remain unavailable.

Keep account settings and workspace security distinct

Your own account settings cover your personal sign-in and security. Access Control → Sign-in settings controls workspace sign-in options and needs separate administrative permission. Access Control → Activity log supports investigation of recorded account and role actions. Access to that history does not grant permission to change accounts.

Troubleshooting

Problem	What to check
A colleague can sign in but cannot perform a task	Inspect their effective permissions, the task's requirements and any workflow restrictions.
A role name looks correct but an action is missing	Inspect its current permissions; the role may be customized.
An employee cannot find their own records	Check the account's employee link and the relevant self-service requirements.
Access still looks unchanged	Refresh the session; allow for the documented refresh window.
A permitted action is still unavailable	Check record status, reporting scope and workspace feature availability. Permission alone does not bypass business rules.
Users or Roles is unavailable	User administration and role reading require different permissions.

What was verified

The Users list, built-in Roles list, Employee role's Permissions tab and Permissions catalogue were inspected in light theme. No account, assignment, role permission or security setting was changed. These screenshots show an administrative session; they do not demonstrate a restricted employee's access.